Secure intra- and inter-domain handover

Abstract

To achieve a secure and fast handover in a distributed mobile communication environment (10), the control functionality is lying at the borderline between wireless and wire-bound communication network elements, and it is proposed to, firstly, execute a mutual authentication between a mobile device (26) and a new access point (14) using security context information previously transmitted to the new access point. Then, after successful mutual authentication, a handover will be executed from the current access point (12) to the new access point (14).

Description

[0001]Applicant hereby claims priority from PCT / EP2004 / 000562 filed on Jan. 23, 2004, PCT / EP2003 / 010183 filed on Sep. 12, 2003, PCT / EP2003 / 010184 filed on Sep. 12, 2003, and PCT / EP2003 / 010185 filed on Sep. 12, 2003, priority, which are hereby incorporated by reference in their entirety.[0002]The present invention relates to a method of handover in a distributed mobile communication environment, and in particular to a secure intra- and inter-domain handover for a distributed mobile communication environment.BACKGROUND ART[0003]Future generation mobile communication networks will have a control intelligence distributed to the edge between wireless and wireline infrastructure elements. Thus, distribution of intelligence to the edge of the mobile communication environment will be referred to as distributed mobile communication environment in the following. While in the following reference will be made to specific examples of such distributed mobile communication environments, it should ...

AI Technical Summary

Benefits of technology

[0020]Further, an important advantage of the present invention is that it is not restricted to handover within a single communication domain, also referred to as intra-domain handover, but may also be applied to handover between different communication domains, also referred to as inter-domain handover in the following.

[0021]Therefore, only the present invention allows for a fast and secure handover for an intra- / inter-domain handover scenario in mobile communication networks, where intelligence, i.e. handover control related functionality, is provided at the borderline between wireless and wireline bounded communication within the environment.

[0022]According to a preferred embodiment of the present invention, secure handover is executed between access devices of a same communication domain, i.e. as an intra-domain handover.

[0023]Here, it is proposed to have different security keys also referred to as authentication values in the following. A first such key is a master key which is generated during log-on of the mobile device at an authentication server. This master key or master secret authentication value is then passed to different access points.

[0024]Preferably, the different access points and the authentication server have a secure connection and log-in takes place on the basis of a mutual authentication between the mobile device and the related access point.

[0025]According to the present invention, it is proposed that the access device and the mobile device derive a communication key for communication between the access point and the mobile device and further a third, so-called roaming key.

Problems solved by technology

Today, problems arise, e.g., for intra-domain handover, i.e. a handover between access points and / or base stations of the same mobile communication environment.

In particular, existing solutions do not allow for a fast and at the same time authenticated handover between a first network access point and a second network access point in support of a fast, secure, and seamless handover.

Actually, this is a big problem for future generation mobile communications using distributed networks.

While this standard provides a solution for secure transfer of context information to a new access point, it does nevertheless not define what a context information should actually contain.

Further, the standard IEEE 802.11f does not define how mutual authentication should take place at the new access point.

Therefore, the approach described in IEEE 802.11i is certainly not suitable for fast roaming, in particular when there is a lot of traffic in the backbone network and the access server is located far away from the access point or equivalently hotspot.

However, what is not discussed is the issue of sending context information with different stakeholders and technologies spread out over different wireless communication networks.

Nevertheless, this protocol does not relate to distributed mobile communication environment and inter-domain handover and it does also not discuss issues related to re-authentication and mutual authentication during handover, in particular with respect to different stakeholders.

Images